FKIE_CVE-2011-0550

Vulnerability from fkie_nvd - Published: 2011-08-15 19:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via (1) the token parameter to portal/Help.jsp or (2) the URI in a console/apps/sepm request.
References
cve@mitre.orghttp://secunia.com/advisories/43662Vendor Advisory
cve@mitre.orghttp://securitytracker.com/id?1025919
cve@mitre.orghttp://www.osvdb.org/74465
cve@mitre.orghttp://www.osvdb.org/74466
cve@mitre.orghttp://www.securityfocus.com/bid/48231
cve@mitre.orghttp://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110810_00
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/69136
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43662Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1025919
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/74465
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/74466
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/48231
af854a3a-2127-422b-91ae-364da2661108http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110810_00
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/69136
Impacted products
Vendor Product Version
symantec endpoint_protection 11.0.6000
symantec endpoint_protection 11.0.6100
symantec endpoint_protection 11.0.6200
symantec endpoint_protection 11.0.6200.754
symantec endpoint_protection 11.0.6300
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection:11.0.6000:*:*:*:*:*:*:*",
              "matchCriteriaId": "74A97619-5D8B-4634-BFA6-F73285865823",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection:11.0.6100:*:*:*:*:*:*:*",
              "matchCriteriaId": "1CF5F84C-91C1-4395-B988-9F9E4F87D8B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection:11.0.6200:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0C0EFA7-71FE-48C9-97D3-F414F49DB495",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection:11.0.6200.754:*:*:*:*:*:*:*",
              "matchCriteriaId": "142BCA40-386C-4498-BECB-22BC07B240DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection:11.0.6300:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD725528-A19A-465E-B427-EF426104B7AF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via (1) the token parameter to portal/Help.jsp or (2) the URI in a console/apps/sepm request."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS en el Web Interface en el Endpoint Protection Manager en Symantec Endpoint Protection (SEP) v11.0.600x hasta v11.0.6300 permite a atacantes remotos inyectar c\u00f3digo script de su elecci\u00f3n o HTML a trav\u00e9s del (1) token de par\u00e1metro portal/Help.jsp o (2) la URI en una petici\u00f3n console/apps/sepm."
    }
  ],
  "id": "CVE-2011-0550",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-08-15T19:55:03.567",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43662"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1025919"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/74465"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/74466"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/48231"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2011\u0026suid=20110810_00"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69136"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1025919"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/74465"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/74466"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/48231"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=2011\u0026suid=20110810_00"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69136"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.